Quantum computing has the capability to “break” encryption on federal systems and unlock secure information, and experts warn the risks could fully materialise by 2030.
Quantum computers work much faster than standard computers and can undermine secure encryption. According to the Government Accountability Office (GAO), federal agencies must transition toward more secure cryptography; however, they have not adequately prepared by identifying vulnerable systems or testing quantum-resistant algorithms.
Following an investigation, the GAO determined that federal action must be taken to prepare for the accelerating cyber threat posed by quantum technology.
“Today’s quantum computers cannot yet break this cryptography,” the GAO noted. “But a future quantum computer of sufficient size and sophistication—referred to as a cryptographically relevant quantum computer (CRQC) – could potentially do so for certain cryptography.”
Depending on various factors, development timelines could vary widely if the growth rate of qubits accelerates.
The GAO evaluated a framework outlining three key actions agencies should take to manage the transition, backed by adequate funding and testing of post-quantum cryptography.
While quantum computing is not yet advanced enough to decrypt and access sensitive information, the GAO warned that until agencies address these weaknesses, they will remain ill-prepared to defend against CRQC threats.
For decades, digital security has relied heavily on public-key cryptography. However, quantum computers operate fundamentally differently, processing complex calculations far faster. A fully realised CRQC will be able to reverse these mathematical mechanisms, enabling malicious actors to compromise authentication and decrypt stored data.
Although the White House and the Office of Management and Budget have issued clear directives to combat this risk, the GAO’s evaluation of 24 Chief Financial Officers Act agencies revealed a systemic failure to implement basic preventative defenses.
The GAO found that most agencies have only partially mapped out their digital assets, failing to maintain annually updated inventories that detail where vulnerable cryptographic algorithms reside within their systems. Furthermore, agencies have struggled to budget specifically for the migration to post-quantum cryptography, leaving long-term financial plans incomplete.
While federal bodies recognize the threat in theory, almost none have begun actively testing post-quantum cryptographic algorithms in live environments. Sixteen agencies argued that testing was premature because commercial software vendors have yet to integrate the new algorithms into standard products. Out of the 23 agencies given explicit recommendations by the watchdog, only 12 fully agreed to adopt them.
To avoid a massive compromise of national security data, the GAO’s roadmap demands that agencies catalogue all high-value assets, project exact funding requirements for the transition, and stop waiting for turnkey solutions.
Co-located with Identity Week Europe 2027 in Amsterdam, Tech in Gov Europe explores how emerging quantum computing threats and post-quantum cryptography are reshaping long-term digital public infrastructure strategies. Discover how government leaders are migrating critical public sector systems to quantum-safe encryption standards to ensure robust identity management and citizen data security.
